Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

INT-4342: White List for Payload Deserializer

Browse Source 
JIRA: https://jira.spring.io/browse/INT-4342

Use similar code to Spring AMQP to add white list support for Integration's
use of the `DeserializingMessageConverter`; introduce the `WhiteListDeserializingMessageConverter`.

Polishing

Missed this change in PR.

Fix XSD attribute
This commit is contained in:
Gary Russell
2017-09-08 13:58:59 -04:00
committed by Artem Bilan
parent 5749c5b237
commit 0d495294ed
16 changed files with 385 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/reference/asciidoc/transformer.adoc
View File

@@ -116,9 +116,13 @@ These will use standard Java serialization by default, but you can provide an im
----
<int:payload-serializing-transformer input-channel="objectsIn" output-channel="bytesOut"/>
<int:payload-deserializing-transformer input-channel="bytesIn" output-channel="objectsOut"/>
<int:payload-deserializing-transformer input-channel="bytesIn" output-channel="objectsOut"
white-list="com.mycom.*,com.yourcom.*"/>
----
IMPORTANT: When deserializing data from untrusted sources, you should consider adding a `white-list` of package/class patterns.
By default, all classes will be deserialized.
====== Object-to-Map and Map-to-Object Transformers
Spring Integration also provides _Object-to-Map_ and _Map-to-Object_ transformers which utilize the JSON to serialize and de-serialize the object graphs.